I implemented and connected both the provider side and consumer side of AWS PrivateLink with AWS CDK

			
			import * as cdk from "aws-cdk-lib";
import * as ec2 from "aws-cdk-lib/aws-ec2";
import * as elbv2 from "aws-cdk-lib/aws-elasticloadbalancingv2";
import * as elbv2_targets from "aws-cdk-lib/aws-elasticloadbalancingv2-targets";
import * as iam from "aws-cdk-lib/aws-iam";
import { Construct } from "constructs";

const CONSUMER_ACCOUNT_ID = process.env.CONSUMER_ACCOUNT_ID;

export class PrivateLinkProviderConstruct extends Construct {
  constructor(scope: Construct, id: string) {
    super(scope, id);

    /**
     * Creating a VPC
     */
    const vpc = new ec2.Vpc(this, "VPC", {
      subnetConfiguration: [
        // Create only private subnets assuming connection to ALB will be allowed only via PrivateLink
        {
          name: "PrivateIsolated",
          subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
        },
      ],
      maxAzs: 2, // Specifying minimum configuration for testing. ALB requires 2 AZs
      natGateways: 0, // Set NAT Gateway to 0 as it's not used in this test
      restrictDefaultSecurityGroup: true, // Restrict default security group to minimize access permissions
    });

    // -----------------------------------------------
    // ↓ Implementation for access verification from consumer side
    // -----------------------------------------------

    /**
     * Creating an ALB
     */
    const alb = new elbv2.ApplicationLoadBalancer(
      this,
      "ApplicationLoadBalancer",
      {
        vpc,
        vpcSubnets: {
          subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
        },
      }
    );

    /**
     * Creating a listener for ALB
     *
     * TODO: Recommended to configure certificates for HTTPS
     */
    alb.addListener("AlbListener", {
      port: 80,
      defaultAction: elbv2.ListenerAction.fixedResponse(200, {
        messageBody: "Hello from ALB!",
      }),
    });

    // -----------------------------------------------
    // ↓ Implementation required for PrivateLink provider side
    // -----------------------------------------------

    /**
     * Creating an NLB
     */
    const nlb = new elbv2.NetworkLoadBalancer(this, "NetworkLoadBalancer", {
      vpc,
      internetFacing: false,
      vpcSubnets: {
        subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
      },
    });

    /**
     * Creating a target group for NLB
     */
    const nlbTargetGroup = new elbv2.NetworkTargetGroup(
      this,
      "NlbTargetGroup",
      {
        port: 80,
        vpc,
      }
    );

    /**
     * Adding ALB as a target for NLB
     */
    nlbTargetGroup.addTarget(
      new elbv2_targets.AlbListenerTarget(alb.listeners[0])
    );

    /**
     * Creating an NLB listener
     */
    nlb.addListener("NlbListener", {
      port: 80,
      defaultTargetGroups: [nlbTargetGroup],
    });

    /**
     * Creating a VPC Endpoint Service (PrivateLink provider)
     */
    const vpcEndpointService = new ec2.VpcEndpointService(
      this,
      "VpcEndpointService",
      {
        vpcEndpointServiceLoadBalancers: [nlb],
        acceptanceRequired: false, // Disable automatic acceptance of connection requests
        allowedPrincipals: [
          new iam.ArnPrincipal(`arn:aws:iam::${CONSUMER_ACCOUNT_ID}:root`),
        ],
      }
    );

    /**
     * Output the VPC endpoint service name
     */
    new cdk.CfnOutput(this, "ProviderVpcEndpointServiceName", {
      value: vpcEndpointService.vpcEndpointServiceName,
    });

    /**
     * TODO: Configure private DNS name for VPC endpoint service using certificates and HTTPS
     * @see https://docs.aws.amazon.com/ja_jp/vpc/latest/privatelink/manage-dns-names.html
     */
  }
}
```The implementation required on the PrivateLink provider side is creating an NLB and creating a VPC endpoint service. The connection flow is as follows:

```shell
NLB → VPC endpoint service → ALB → ALB listener → ALB target group → ALB target (EC2, etc.)

		

			
			import * as cdk from "aws-cdk-lib";
import * as ec2 from "aws-cdk-lib/aws-ec2";
import * as logs from "aws-cdk-lib/aws-logs";
import * as lambda_nodejs from "aws-cdk-lib/aws-lambda-nodejs";
import { Construct } from "constructs";

const PROVIDER_VPC_ENDPOINT_SERVICE_NAME =
  process.env.PROVIDER_VPC_ENDPOINT_SERVICE_NAME || "";

export class PrivateLinkConsumerConstruct extends Construct {
  constructor(scope: Construct, id: string) {
    super(scope, id);

    /**
     * Creating VPC
     */
    const vpc = new ec2.Vpc(this, "VPC", {
      subnetConfiguration: [
        // Create only private subnets assuming communication will only be via VPC endpoints
        {
          name: "PrivateIsolated",
          subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
        },
      ],
      maxAzs: 1, // Specifying minimum configuration for testing. ALB creation requires 2 AZs
      natGateways: 0, // Set NAT Gateway to 0 as it's not used in this test
      restrictDefaultSecurityGroup: true, // Restrict default security group to minimize access permissions
    });

    // -----------------------------------------------
    // ↓ Implementation required on the PrivateLink consumer side
    // -----------------------------------------------

    /**
     * Security group for VPC Endpoint
     *
     * MEMO: Explicitly created to limit connections only to the VPC Endpoint. (If not explicitly created, allowAllOutbound is enabled by default)
     */
    const vpcEndpointSecurityGroup = new ec2.SecurityGroup(
      this,
      "VpcEndpointSecurityGroup",
      {
        vpc,
        allowAllOutbound: false,
      }
    );

    /**
     * Creating VPC Endpoint
     */
    const vpcEndpoint = new ec2.InterfaceVpcEndpoint(
      this,
      "PrivateLinkEndpoint",
      {
        vpc,
        service: new ec2.InterfaceVpcEndpointService(
          PROVIDER_VPC_ENDPOINT_SERVICE_NAME
        ),
        subnets: {
          subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
        },
        securityGroups: [vpcEndpointSecurityGroup],
        open: false, // Disable the setting that allows all traffic from within the VPC to this endpoint by default
        /**
         * Enable this if the provider has set up a private DNS name for the VPC endpoint service
         * @see https://docs.aws.amazon.com/ja_jp/vpc/latest/privatelink/manage-dns-names.html
         */
        // privateDnsEnabled: true,
      }
    );

    // -----------------------------------------------
    // ↓ Implementation for verifying access to provider-side resources
    // -----------------------------------------------

    /**
     * Security group for Lambda
     *
     * MEMO: Explicitly created to limit connections only to the VPC Endpoint. (If not explicitly created, allowAllOutbound is enabled by default)
     */
    const lambdaSecurityGroup = new ec2.SecurityGroup(
      this,
      "LambdaSecurityGroup",
      {
        vpc,
        allowAllOutbound: false,
      }
    );

    /**
     * Get VPC endpoint DNS name
     */
    const firstDnsEntry = cdk.Fn.select(0, vpcEndpoint.vpcEndpointDnsEntries);
    const consumerVpcDnsName = cdk.Fn.select(
      1,
      cdk.Fn.split(":", firstDnsEntry)
    );

    /**
     * Lambda function for testing PrivateLink connection
     */
    new lambda_nodejs.NodejsFunction(this, "PrivateLinkTestLambda", {
      entry: "handler.ts",
      logGroup: new logs.LogGroup(this, "LogGroup", {
        removalPolicy: cdk.RemovalPolicy.DESTROY,
      }),
      vpc,
      vpcSubnets: {
        subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
      },
      securityGroups: [lambdaSecurityGroup],
      environment: {
        CONSUMER_VPC_ENDPOINT_DNS_NAME: consumerVpcDnsName,
      },
    });

    /**
     * Allow access from lambdaFunction to VPC Endpoint on port 80
     */
    vpcEndpoint.connections.allowFrom(lambdaSecurityGroup, ec2.Port.tcp(80));
  }
}
```The implementation required as a consumer of PrivateLink is creating a VPC endpoint. The connection flow is as follows:

```shell
Connection source (in this case, Lambda function) → VPC endpoint → PrivateLink → Provider-side resource

		

			
			$ aws lambda invoke \
  --function-name ${FUNCTION_NAME} response.json
{
    "StatusCode": 200,
    "ExecutedVersion": "$LATEST"
}
$ cat response.json
"Hello from ALB!"

		

			
			/**
 * VPC Endpoint creation
 */
const vpcEndpoint = new ec2.InterfaceVpcEndpoint(this, "PrivateLinkEndpoint", {
  vpc,
  service: new ec2.InterfaceVpcEndpointService(
    PROVIDER_VPC_ENDPOINT_SERVICE_NAME
  ),
  subnets: {
    subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
  },
  securityGroups: [vpcEndpointSecurityGroup],
  open: false,
  privateDnsEnabled: true, // ← This needs to be false or omitted
});